CVE-2025-11692: WordPress Zip Attachments Auth Bypass

CVE-2025-11692 Overview

CVE-2025-11692 affects the Zip Attachments plugin for WordPress in all versions up to and including 1.6. The vulnerability stems from missing authorization and capability checks in the download.php file. Unauthenticated attackers can invoke the download handler to delete arbitrary files from the current wp_upload_dir directory. The flaw is categorized under Missing Authorization [CWE-862] and is exploitable remotely over the network without user interaction. The issue was published to the National Vulnerability Database (NVD) on October 15, 2025.

Critical Impact
Unauthenticated remote attackers can delete arbitrary files within the WordPress uploads directory, causing content loss and potential site disruption.

Affected Products

WordPress Zip Attachments plugin, all versions through 1.6
WordPress sites with the vulnerable download.php endpoint exposed
Any deployment where the plugin remains active and unpatched

Discovery Timeline

2025-10-15 - CVE-2025-11692 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11692

Vulnerability Analysis

The Zip Attachments plugin exposes a download.php script that handles file operations for zipped attachments. The script fails to verify the caller's authentication state or WordPress capability before performing file operations. As a result, requests to the endpoint reach file deletion logic without any authorization gate. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.224% with a percentile of 13.1, indicating limited observed exploitation activity to date.

Root Cause

The root cause is a Missing Authorization weakness [CWE-862] in download.php. The handler processes attacker-controlled input that references files within wp_upload_dir and invokes deletion routines without calling current_user_can(), verifying a nonce, or checking authentication. Any HTTP client can therefore trigger file removal within the uploads directory scope.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the plugin's download.php endpoint with a file reference targeting the WordPress uploads directory. Because no capability check runs before the delete operation, the server removes the referenced file. Repeated requests can destroy multiple assets, including media files referenced by published posts and pages. The vulnerable code path is documented in the WordPress Plugin Trac browser for Zip Attachments 1.6 and analyzed in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-11692

Indicators of Compromise

Unexpected HTTP requests to /wp-content/plugins/zip-attachments/download.php from unauthenticated sources
Missing or deleted files within wp-content/uploads/ that were previously referenced by published content
Access log entries with request parameters pointing to files in wp_upload_dir
Broken image or attachment links appearing across multiple posts within a short window

Detection Strategies

Monitor web server access logs for GET or POST requests to the plugin's download.php path originating from non-authenticated sessions
Track file system changes in wp-content/uploads/ using integrity monitoring or WordPress activity logging plugins
Alert on high-volume requests to any single plugin endpoint from one source IP address

Monitoring Recommendations

Enable file integrity monitoring on the WordPress uploads directory and preserve baseline hashes
Forward WordPress and web server logs to a centralized logging platform for correlation and retention
Configure alerts for unauthenticated requests reaching plugin PHP files that perform state-changing operations

How to Mitigate CVE-2025-11692

Immediate Actions Required

Deactivate the Zip Attachments plugin on all WordPress sites until a patched version is confirmed installed
Audit wp-content/uploads/ against backups to identify any files removed by exploitation attempts
Review web server access logs for prior requests to download.php and block offending source addresses
Restore missing media assets from verified backups before republishing affected content

Patch Information

At the time of NVD publication, all versions up to and including 1.6 are vulnerable. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory for a fixed release and apply it immediately once available.

Workarounds

Remove or rename the download.php file within the plugin directory to disable the vulnerable endpoint
Add a web application firewall rule that blocks unauthenticated requests to /wp-content/plugins/zip-attachments/download.php
Restrict access to the plugin directory via web server configuration until an official patch is deployed

bash

# Example nginx rule to block the vulnerable endpoint
location ~* /wp-content/plugins/zip-attachments/download\.php$ {
    deny all;
    return 403;
}